On 2021/8/27 16:36, Herbert Xu wrote:
On Sat, Aug 21, 2021 at 05:07:00PM +0800, yekai(A) wrote:
On 2021/8/21 15:25, Herbert Xu wrote:
On Fri, Aug 13, 2021 at 05:40:23PM +0800, Kai Ye wrote:
+static int sec_ahash_import(struct ahash_request *req, const void *in)
+{
+ /*
+ * Import partial state of the transformation. This function loads the
+ * entire state of the ongoing transformation from a provided block of
+ * data so the transformation can continue from this point onward.
+ */
+ struct sec_req *sreq = ahash_request_ctx(req);
+
+ memcpy(sreq, in, sizeof(struct sec_req));
+ return 0;
+}
Please explain how this works given that you've got pointers in
struct sec_req?
Thanks,
We have set the sec_req size by use the "crypto_ahash_set_reqsize" in ahash
tfm init process. The crypto will allocate memory for the sec_req by
"__ctx[]". And we can got the pointers by use ahash_request. like
void *temp = ahash_request_ctx(req);
struct sec_req *sreq = (struct sec_req)temp;
The value of halg.statesize is sizeof(struct sec_req), so the user can get
the statesize.
The data you get from the import could be random garbage. Please
explain how you avoid dereferencing random pointers in your code
through the import path.
Thanks,
I refered to other people's plans. Modify the value of halg.statesize
is sizeof(struct sec_req) + sizeof(u32), So user can allocate an extra
sizeof(u32) memory. The driver will write a tag number to the addr in
the export process, then the driver will check the pointers by the tag
number through the import path.
I think this plan can avoid random pointers.
Thanks
Kai
